Privacy Policy — VseBots

This English version is provided for convenience and Meta review. In case of any discrepancy, the Russian version of this Privacy Policy, available at https://vsebots.com/policy/ru, shall prevail.

1. Scope and key terms

1.1. This Privacy Policy explains how the Controller processes personal data when a user uses VseBots, including its account area, automation tools, connected communication channels and support.

1.2. “Owner” means a VseBots user who creates an automation and connects a communication channel. “Recipient” means a person whose message, comment or other event is processed by an automation created by an Owner. “Connected channel” means a third-party communication service voluntarily connected by an Owner, including Instagram, Telegram, MAX or another channel made available in VseBots.

1.3. This Policy does not replace the privacy policies or terms of a Connected Channel. Such providers may process data as independent controllers under their own documents.

2. Data we process

2.1. Depending on the features used, we may process:

— account and profile data, such as email address, telephone number, account identifier, registration date, account status and information voluntarily provided by the user;

— technical and security data, such as IP address, device and browser information, session and cookie identifiers, logs of authentication and security events;

— automation and Connected Channel data, such as automation settings, connection status, technical identifiers and public account information, recipient identifiers, incoming messages and comments, results of an automation, activity logs and technical events;

— support correspondence and materials voluntarily sent to support;

— payment, subscription and usage data where the relevant functionality is enabled.

2.2. Message and comment content is processed only to the extent necessary to perform the automation configured by its Owner. We do not sell personal data.

2.3. The Controller does not seek to process special categories of personal data or biometric data for identification. Owners must not submit third-party data without a lawful basis.

3. Purposes and legal grounds

3.1. We process data to provide and secure the Service, create and maintain accounts, connect channels, execute automations, receive channel events, send the responses configured by an Owner, provide support, prevent fraud and abuse, maintain technical logs, comply with legal obligations and protect the rights of the Controller, users and third parties.

3.2. Processing may be based on consent where required, performance of an agreement with the user, compliance with legal obligations, and the Controller’s legitimate interests in security, reliability and abuse prevention.

3.3. The Owner independently decides which channels to connect and which automations to create. The Owner is responsible for having a lawful basis to process Recipient data and send messages, and must not use VseBots for spam, infringement or a breach of Connected Channel rules.

4. Connection credentials and automation data

4.1. When a channel is connected, the Controller may process access tokens and other technical authorization data necessary to establish and maintain that connection. These credentials are not displayed to other VseBots users.

4.2. The Controller may process messages, comments, media references and public profile information received from a Connected Channel where this is necessary to execute the Owner’s configured automation, maintain delivery reliability, investigate errors or prevent duplicate actions.

4.3. Disconnecting a channel stops future processing through that connection, subject to limited retention of records required for security, accounting, legal compliance or dispute resolution.

5. Recipients of data

5.1. Data may be disclosed only as necessary to provide the Service or comply with law, including to:

— hosting, infrastructure, storage, backup and security providers;

— payment providers and payment infrastructure where payments are used;

— support, accounting, legal and technical contractors bound by confidentiality obligations;

— Connected Channel providers and their APIs, including Meta Platforms, Inc. for Instagram, Telegram, MAX and other channels voluntarily connected by an Owner;

— governmental authorities, courts and other recipients where disclosure is required by applicable law.

5.2. Only the minimum data needed for the relevant function or automation is shared with a Connected Channel. Connected Channel providers may process data under their own policies.

6. International processing and data location

6.1. The main backend, user database, uploaded files, generation results and backups are hosted in the Russian Federation using Timeweb Cloud.

6.2. Certain Connected Channel features and APIs may require processing or transfer outside the Russian Federation, including the use of Meta Platforms services for Instagram and overseas technical infrastructure. Such processing is limited to what is necessary for the respective feature and is organized with regard to applicable legal requirements.

7. Retention and security

7.1. Personal data is retained no longer than necessary for the purposes described in this Policy, unless a longer period is required or permitted by law, an agreement, accounting obligations, security needs or dispute resolution.

7.2. The Controller uses reasonable legal, organizational and technical safeguards, including access controls, protected credential storage, backups, event logging, secure transmission where applicable, and access reviews.

8. Your rights and contact

8.1. Subject to applicable law, a user may request information about processing, correction, deletion or restriction of personal data, withdraw consent where consent is the legal basis, and opt out of marketing communications.

8.2. To submit a request, contact pr@vsebots.com. Please provide sufficient information to identify the relevant account or connection without disclosing third-party data.

8.3. A Recipient should first contact the Owner who configured the relevant automation. The Controller may request additional information where needed to protect another person’s data or verify the request.

9. Changes to this Policy

9.1. We may update this Policy when the Service, connected channels, applicable law or data-processing practices change. The current English version is published at https://vsebots.com/policy, and the controlling Russian version is published at https://vsebots.com/policy/ru.